Let's say person A (which uses Microsoft 365) sends an email to person B on any other server. The used e-mail address is wrong or no longer existent and the server sends a response back, that this message couldn\u2019t be delivered. In this notice there is the IP address of the responding server, which gets classified from our system as malicious. So, the message couldn\u2019t be delivered is now going to quarantine and the user does not know, that it wasn\u2019t or received any notifications. Hence is this the way it should work or is this an issue?<\/p>\n
In terms of product behavior, the detected emails are handled according to the action setting configured in the policy on the Collaboration Protection portal where the default action setting is to move the item into quarantine. Of course, it is possible to change to other action setting during detection such as "Change Subject and unlink URLs" and etc by going to "Exchange" tab > "URL Scanning" > "Malicious URL" > "If a malicious URL is detected, the system will take the following action:" and select a desired action from the list.<\/p>\n
As for your concern on the users\/recipients who is not aware of the quarantined email, this could be avoided by enabling the setting of "Notify the user about detections with the following severities:" setting at the same place as the action setting above. Please refer to the attached screenshot for more details.<\/p>\n","protected":false},"excerpt":{"rendered":"
Partner inquired if lets say person A (which uses Microsoftt 365) sends an email to person B on any other server.
\nThe used e-mail address is wrong or no longer existent and the server sends a response back, that this message couldn\u2019t be delivered. In this notice there is the IP address of the responding server, which gets classified from our system as malicious.<\/p>\n
So the message couldn\u2019t be delivered is now going to quarantine and the user does not know, that it wasn\u2019t or received any notificati<\/p>\n","protected":false},"template":"","support_article_product":[101],"class_list":["post-4023","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000013095","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:04:56","import_hash":"3655502fea10decba644361c87eed54c68542282","vanilla_article_id":31622,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/31622-why-users-recipients-who-is-not-aware-of-the-quarantined-email-is-not-been-notified-on-elements-collaboration-protection","vanilla_kb_id":30,"vanilla_category_id":124,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4023","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4023"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4023"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}